The rules for protecting Controlled Unclassified Information (CUI) are changing again, and this time they reach far beyond the defense industrial base. In June 2026, the FAR Council released an updated CUI proposed rule that standardizes how CUI is identified and flowed down across federal contracts, and, most significantly, makes NIST SP 800-171 Revision 3 the baseline for contractors handling CUI. For any company navigating flow-down requirements, it's the most important de
